Just a note, if you are running the PasswordState service under a different account, you have to explicitly give it permissions to read the encryption keys, if you encrypt the database connection string, by using this command:
aspnet_regiis -pa "NetFrameworkConfigurationKey" "Domain\Username of service account"